A new method has been discovered to circumvent security measures in modern processors by manipulating their memory controllers This article explores memory carveouts vulnerable. . The research, which is open-source and available on GitHub as skitter-creek-bath-salts, targets the DRAM controller's address-translation logic, bypassing protections around System Management Mode, Platform Security Processor, and CPU microcode.
His findings reveal that even defenses like SEV (Software Enforced Virtualization), SGX (Secure Execution Zone), TDX (Trust Domain Extensions), TrustZone, and firmware-based memory carveouts are vulnerable if the physical addresses generated by a CPU do not remain fixed or predictable once they leave the processor core. This class of vulnerability is not tied to a single flaw that can be easily patched.
The same method also pulled out the System Management Mode interrupt handler from SMRAM, a region marketed as "locked" by the chipset, and recovered raw CPU register state, including page-table roots and APIC configuration, while cores were in C6 low-power idle mode. While the proof-of-concept published on GitHub targets an older AMD platform whose datasheets documented enough of the controller’s registers to reverse-engineer the transform, Domas notes that this architectural pattern—channel and rank interleaving, bank swizzling, and chip-select mapping—is ubiquitous across virtually every modern memory controller, spanning AMD, Intel, ARM, and RISC-V designs.
